{"answers":{"affected":"1 open source package ship an affected version, including btc-fee-estimator.","exploited":"There is no known exploitation of MAL-2026-17781 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17781 is a malicious package in btc-fee-estimator, published on 11 Oct 2026."},"fix_prompt":"MAL-2026-17781 is a malicious package: btc-fee-estimator (RubyGems). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17781/ (Markdown: https://insights.sbomify.com/MAL-2026-17781/index.md)","id":"MAL-2026-17781","markdown":"https://insights.sbomify.com/MAL-2026-17781/index.md","name":"MAL-2026-17781","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The gem's extconf.rb decodes a base64-encoded Ruby payload and evals it inside a detached forked process during `gem install`. The decoded payload opens a TCP connection to the hardcoded host 45.138.12.177 on port 8089 and bridges it to /bin/sh, providing interactive shell access on the installer's machine. Execution is gated by anti-analysis checks that skip CI environments, hostnames matching firecracker/sandbox/vagrant patterns, generated usernames, analysis paths such as /opt/rubygems and /tmp, machines with uptime under 1800 seconds, and hosts lacking developer artifacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle) — targeting real developer workstations while remaining dormant in scanners. The gemspec and README describe unrelated functionality (a bitcoin fee estimator / bitcoin_rpc_lite helpers), and the shipped library exposes only stub methods (build_id, healthy?); the package has no legitimate functionality, serving solely as a cover for the install-time backdoor.","ecosystems":["RubyGems"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in btc-fee-estimator (RubyGems)","id":"MAL-2026-17781","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"RubyGems","fixed":[],"introduced":[],"last_affected":[],"package":"btc-fee-estimator","purl":"pkg:gem/btc-fee-estimator","source":"MAL-2026-17781"}],"products":null,"published":"2026-10-11","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17781/"}